Repository navigation

Require explicit trace_prompt opt-in for prompt payload logging #36

	# Fails when a workflow job that calls Claude lacks its security settings.
	# The rules are in CLAUDE.md, "Security hardening for GitHub Actions".
	name: Security check for workflows that call Claude

	on:
	pull_request:
	push:
	branches: [main]

	permissions:
	contents: read

	jobs:
	workflow-hardening:
	name: Check security settings
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- name: Checkout repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Check security settings of workflows that call Claude
	run: python3 .github/scripts/check_workflow_hardening.py